These Launch Hardening Terms (the “Hardening Terms”) apply when your organization buys Launch Hardening from Optiarms Inc., doing business as D.A.R.Y.L. Labs (“Daryl Labs”, “we”, “us” or “our”). They supplement our Terms of Service (the “Terms”), which also apply, together with the Privacy Policy, the Data Processing Addendum and the Acceptable Use Policy. Capitalized words not defined here have the meaning given in the Terms. If these Hardening Terms conflict with the Terms on a subject they cover, these Hardening Terms control for Launch Hardening only.
By placing an order you confirm that you are buying on behalf of a business, that you are authorized to bind it, and that it owns or administers the project you ask us to harden.
1. What Launch Hardening is
Launch Hardening (the “Hardening”) is a one-time, fixed-fee service in which a member of our team, working with Daryl, reviews the access controls of one Supabase project behind your app and fixes the problems found, so that data is readable and writable only by the people who should have it. It is a focused security service, not general development work.
Daryl Shield is in early access. Some of Daryl’s automated capabilities, including proof and replay, may not be available yet when you buy. These Hardening Terms describe what we deliver either way, and section 3 explains what happens when a capability is not available.
2. Price and scope
2.1 Fee
The fee is $499, paid in full when you order, plus any applicable taxes. It is a one-time charge and does not renew. Payment is processed by our payment processor.
2.2 Scope caps
The fee covers the following, which together are the “Scope”:
| Item | Included |
|---|---|
| Supabase projects | 1 project |
| Database tables and views exposed to your app | Up to 40 |
| Database functions and edge functions | Up to 10 |
| Storage buckets | Up to 5 |
If your project is larger, we will tell you before starting and agree with you by email which items are in Scope, or quote for the extra work under section 5. Tables in schemas your app cannot reach, and objects managed by Supabase itself, are not counted.
3. Deliverables
For the items in Scope, we will deliver:
- A complete check. Every table, storage bucket and function in Scope reviewed for the access-control problems Daryl looks for, such as row-level security that is off or allows everyone, grants to anonymous users on sensitive tables, public buckets holding private files, functions that run with elevated rights and can be called by anyone, and keys exposed in your app’s code.
- Fixes. Changes to policies, grants, bucket settings and function settings that close the problems found, applied with your approval or delivered as a pull request, as you prefer. Where Daryl’s proof and replay are available for a fix, it is delivered with a proof that it only narrows access, within Daryl’s policy model and the fragment of Postgres and Supabase it supports, and a replay of your app’s recorded requests. Where they are not available, the fix is reviewed manually by our team, and the report says so for that fix.
- A PDF report listing what was checked, what was found, what was changed and why, any problems left open and the reason, and which fixes were proven and replayed and which were reviewed manually.
- A 30-minute call to walk you through the report and answer questions, scheduled at a time that suits you within 30 days of delivery.
- 30 days of Shield for the hardened app, starting on delivery, at no charge, so that drift is watched after we finish. It ends after 30 days unless you choose a paid plan; we will not charge you for Shield without your agreement. Shield is provided under the Terms.
4. Schedule
4.1 The clock
We aim to deliver within 3 business days. The clock starts when you have connected the access described in section 7 and it is working. Business days are Monday to Friday, excluding US federal holidays, in the US Eastern time zone.
4.2 Pauses
The clock pauses whenever we are waiting on you: for example, for access, an answer to a question, an approval, a backup, a review of a pull request, or a decision about Scope. It restarts when you respond. We will tell you by email when the clock pauses and why.
4.3 Late delivery
If we miss the delivery target for reasons within our control, we will tell you, give you a new date, and keep working until we deliver. If you would rather stop, you may cancel and we will refund the fee less the value of the work already delivered, which we will explain to you.
5. Change control
Any change to Scope, deliverables, schedule or fee must be agreed by email between you and us. A change is agreed when one side proposes it by email and the other accepts it by reply. A change that adds work may come with a revised fee and delivery date, which we will state before you accept. Nothing outside Scope is done until it is agreed this way.
6. Out of scope
Unless agreed under section 5, Launch Hardening does not include:
- Projects, tables, functions or buckets beyond the Scope caps.
- New features, general bug fixing, performance tuning, data migrations or redesigning your schema.
- Changes to your app’s front-end code, other than identifying exposed keys and telling you how to remove and rotate them.
- Penetration testing, code audits, or review of systems other than the Supabase project in Scope.
- Testing on behalf of, or attestation to, any third party; certifications; or compliance assessments.
- Ongoing monitoring after the included 30 days of Shield, and support beyond the 30-minute call and the warranty in section 9.
7. Your responsibilities
You agree to:
- Provide access. Connect your Supabase project to Daryl through Supabase’s authorization flow, and your code repository if you want fixes as pull requests. We do not ask for, or store, your service-role key or database password.
- Keep backups. Make sure you have a current backup of your project, or that point-in-time recovery is turned on, before we make changes. We make narrowing changes that can be undone, but you remain responsible for your data.
- Name a contact. Give us one person who can answer questions about how your app is meant to work and approve changes, and who will respond within one business day.
- Tell us about any part of the app that relies on open access on purpose, such as a public catalog, so we do not close it.
- Review changes before approving them, and test your app after they are applied.
8. Refunds and cancellation
If we have not started work within 5 business days after you connected access, you may ask for, and we will give, a full refund. If you have not connected access within 30 days of ordering, either of us may cancel and we will refund the fee in full. Once work has started, the fee is not refundable except under section 4.3, or where the law requires. Refunds go back to the original payment method.
9. Warranty and sole remedy
We warrant that we will perform the Hardening with reasonable skill and care, consistent with these Hardening Terms. If a deliverable does not meet that standard, tell us at hello@getdaryl.com within 30 days of delivery, describing the problem. We will re-perform the deficient work at no charge. If we cannot do so within a reasonable time, we will refund the fee. Re-performance, or failing that a refund, is your sole and exclusive remedy for any breach of this warranty.
The warranty does not cover problems caused by changes made to your project after delivery (including changes your app builder makes when it regenerates code or migrations), by information you gave us that was inaccurate, or by your not following our written recommendations.
10. No guarantee of security or compliance
Launch Hardening reduces risk; it does not eliminate it. Except for the warranty in section 9, the Hardening is provided “as is”. We do not guarantee that your project, app or data will be secure, that every vulnerability will be found, or that it will remain secure after delivery. A proof covers only Daryl’s policy model and the fragment it supports, and a replay covers only the requests that were recorded. The Hardening is not an audit or a certification and does not make your app compliant with any law, regulation or standard, including privacy laws, SOC 2, ISO 27001, HIPAA or PCI DSS. You may not describe your app as certified or audited by Daryl Labs. The disclaimers in the Terms also apply.
11. Limitation of liability
To the fullest extent the law allows, the total liability of Daryl Labs and its affiliates, officers, employees and contractors arising out of or relating to Launch Hardening, whether in contract, tort (including negligence) or otherwise, will not exceed the fee you paid for that Hardening ($499). In no event will we be liable for any indirect, incidental, special, consequential or punitive damages, or for lost profits, revenue, data or goodwill, even if advised they were possible. This cap applies to the Hardening itself; the included 30 days of Shield are governed by the Terms, and the two are not added together. Nothing in this section limits liability that cannot be limited by law.
12. Confidentiality and data
We treat what we learn about your project as your Confidential Information under the Terms. We process personal data in your project only as your processor under the Data Processing Addendum. Daryl reads schema, policies, grants and settings, and estimates row counts; it does not copy or read the contents of your tables. The PDF report is yours to share. We may use what we learn, without anything that identifies you or your app, to improve Daryl’s detectors and fixes, as described in the Terms.
13. How this fits with the Terms
These Hardening Terms supplement the Terms and are part of the agreement between your organization and Daryl Labs. Everything in the Terms not changed here applies to Launch Hardening, including governing law, dispute resolution, assignment, force majeure, export controls and notices. We may update these Hardening Terms for future orders; an order is governed by the version in effect when it was placed. Questions about an order can go to hello@getdaryl.com or to the address at the end of this document. Prices for all plans are on the pricing page.
Contact
Optiarms Inc., doing business as D.A.R.Y.L. Labs
6545 Market Ave N, Ste 100
Canton, OH 44721
hello@getdaryl.com
Other documents: Terms · Privacy · DPA · Acceptable use · Disclosure · Subprocessors · Cookies · Affiliate terms